Azure / ResourceModules

This repository includes a CI platform for and collection of mature and curated Bicep modules. The platform supports both ARM and Bicep and can be leveraged using GitHub actions as well as Azure DevOps pipelines.
https://aka.ms/carml
MIT License
724 stars 460 forks source link

[PSRule] Run PSRule pre-flight validation on diff (PR check) #2150

Open eriqua opened 1 year ago

eriqua commented 1 year ago

CARML already has linter and broken links checks running when pull requests are open. The check is not blocking for the PR to be merged.

Note: pull_requests trigger works only for PRs opened from branches, not from forks.

This issue is about extending the PR checks to also run PSRule pre-flight validation on diff (on the code changed by the PR). As a first step, the suggestion is to keep the check non-blocking, allowing PRs to be merged even if they fail PSRule checks.

PR #2094 hosts a PoC running on the whole library. That should be updated to run only on diff.

Collect feedback on the PR and agree on possible missing implementation before merge.

eriqua commented 1 year ago

Suggestion: Move to todo, but wait for #2425 completion. Meanwhile research on how to run PSRule on diff only

eriqua commented 1 year ago

To run PSRule on changed files only ref https://github.com/microsoft/PSRule/blob/main/docs/concepts/PSRule/en-US/about_PSRule_Options.md#inputignoreunchangedpath

# GitHub Actions: Using environment variable
env:
  PSRULE_INPUT_IGNOREUNCHANGEDPATH: true

Ref also https://github.com/microsoft/PSRule/issues/688

eriqua commented 1 year ago

Enabling the option results anyway in a check on the whole repository. This may be due to the token replacement logic, actually changing the files we're supposed to ignore. This needs to be double checked. If confirmed, we should implement a logic that 1. first retrieves changed files, then 2. applies token replacement, then 3. runs psrule only on diff retrieved by step 1

BernieWhite commented 1 year ago

@eriqua Happy to take feedback on this if you can provide more details here or offline.